2936 matches found
GHSA-99VC-XW8J-PHJM Ghost has possible Cross-site Scripting issue
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...
Ghost has possible Cross-site Scripting issue
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...
CVE-2024-23724
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...
CVE-2024-23724: Improper Neutralization of Input During Web Page Generation
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...
Ghost Cross-Site Scripting Vulnerability
Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. A cross-site scripting vulnerability exists in Ghost 5.76.0 and prior versions, which stems from the fact that an attacker can take over any account to interact with an...
CVE-2024-23724
Ghost CMS up to version 5.76.0 is vulnerable to a stored XSS via an SVG profile image containing JavaScript that can interact with the API on localhost:3001, potentially leading to privilege escalation where a contributor can take over any account. The issue is repeatedly described across multipl...
CVE-2024-23724
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...
CVE-2024-23724
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view th...
Cross-site Scripting (XSS)
ghost is vulnerable to Cross-site Scripting XSS. The vulnerability is due to a lack excerptText sanitization within excerpt.js, allowing an attacker to craft malicious payloads that will be rendered in post summaries...
GHSA-FH38-9FGR-454W Cross-site Scripting in Ghost
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...
Cross-site Scripting in Ghost
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...
CVE-2024-23725
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...
Cross site scripting
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...
CVE-2024-23725
CVE-2024-23725 affects Ghost prior to 5.76.0. The vulnerability is an XSS in post excerpts processed by excerpt.js, allowing an attacker to craft payloads rendered in post summaries. Public references in connected sources corroborate the XSS in Ghost and point to the fixed version 5.76.0 (release...
CVE-2024-23725: Improper Neutralization of Input During Web Page Generation
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...
CVE-2024-23725
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...
CVE-2024-23725
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...
CVE-2024-23725
Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...
Ghost Security Breach
Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. A security vulnerability exists in Ghost versions prior to 5.76.0. An attacker exploited the vulnerability to perform cross-site scripting attacks...